https between reverse proxy and server

[tlapik123]

Hi!
I was just starting to setup VW and since I want it to be accessible from internet I port forward on the router to the https reverse proxy. I have the proxy on different host than the server.

Question itself:
Does it make sense to setup https between reverse proxy and server? Is that even possible? (I'm guessing it is since you can enable https via Rocket). If someone sniffs out the http traffic would it be bad or is there some other encryption at play?

Thank you for your answer!

[BlackDex]

Yes, you can do https<>https between the reverse proxy and Vaultwarden.
If all nodes are in your control, then it might be overkill, but if someone could come in-between it could be useful. It just depends on how well you trust your environment.

If someone sniffs the traffic, they could see the encrypted passwords. But there shouldn't be anything crossing the wire which could be used to decrypt the data instantly. They would need to brute-force your master-password first, which is only sent as a hashed value.

They could see icon requests maybe which could disclose sites you have accounts on, but those probably also appear in the reverse proxy logs.

[tlapik123]

Thank you for this comprehensive answer and thank you for working on vaultwarden!